Jetpack 403 warning

  • jason65

    (@jason65)


    1 week ago

    Hello,

    Our WooCommerce website, [Domain removed by moderators], is hosted by Kinsta and uses Cloudflare Pro and Wordfence.

    WordPress Site Health is reporting a critical Jetpack connection issue, stating that WordPress.com can reach the website but receives an HTTP 403 response.

    WooPayments is connected and payments are processing normally.

    Has there been a recent change to the Jetpack connection test that could explain this warning?

    Is there a way to resolve it without removing our existing XML-RPC security restrictions?

    Thank you.

    The page I need help with: [log in to see the link]

Viewing 4 replies - 1 through 4 (of 4 total)
  • softglaze

    (@softglaze)

    4 days, 22 hours ago

    Hi, the 403 means WordPress.com reaches your site, but something in front of WordPress rejects its request to xmlrpc.php. Jetpack uses xmlrpc.php to talk to WordPress.com, so if XML-RPC is blocked for everyone, this check fails, even while WooPayments keeps working.

    Yes, you can keep your XML-RPC restrictions. Allow xmlrpc.php only from the Jetpack IP ranges and keep blocking everyone else. Jetpack’s guide has the current IP list and ready rules: https://jetpack.com/support/how-to-add-jetpack-ips-allowlist/

    With your setup:

    • Cloudflare: your server only sees Cloudflare’s IPs, so add the rule in Cloudflare as a custom WAF rule that blocks xmlrpc.php for every IP outside the Jetpack ranges. The guide has the expression ready to copy.
    • Wordfence: check Tools > Live Traffic for blocked requests to xmlrpc.php from 192.0.x.x addresses.
    • Kinsta: if they block xmlrpc.php for you at the server, ask their support to allow the Jetpack IP ranges for that file.

    Only allow those IPs for xmlrpc.php, not for the whole site.

    Which of these is blocking XML-RPC on your site right now?

    Plugin Support lastsplash (a11n)

    (@lastsplash)

    4 days, 21 hours ago

    Hi @jason65 –

    I’m writing from Jetpack support. I looked at the blocked requests to xmlrpc.php and it appears they are coming from Cloudflare. I’d start there.

    You should be able to locate the reason for the block in your logs by lookin at the Ray ID in the header: CF-Ray: a4fb4fecc81ec9bf-IAD

    Similar to what @softglaze mentioned above, we recommend adjusting the Cloudflare configuration to allow Jetpack’s requests through. We have instructions on how to do that here:

    https://jetpack.com/support/getting-started-with-jetpack/configure-jetpack-cloudflare/

    Once you make those adjustments, let us know. We can then test the connection again.

    softglaze

    (@softglaze)

    4 days, 21 hours ago

    Thanks @lastsplash for checking the logs and confirming it is Cloudflare.

    @jason65, to find the exact rule: in the Cloudflare dashboard open Security > Events (on some dashboards it is the Events tab under Security > Analytics) and filter by that Ray ID. It shows which rule or feature blocked the request. Then allow the Jetpack IP ranges for xmlrpc.php in that rule, as in the Jetpack guide, and let the Jetpack team know so they can test the connection again.

    Thread Starter jason65

    (@jason65)

    4 days, 1 hour ago

    Many thanks to you all.

    Issue is now resolved and reporting fine.

Viewing 4 replies - 1 through 4 (of 4 total)

You must be logged in to reply to this topic.